CVE-2026-102588

MEDIUM 6.5

Moodle: csrf in xml grade import

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.

CWE	CWE-346
Published	Sep 30, 2026
Last Updated	Sep 30, 2026

Stay Ahead of the Next One

Get instant alerts for

Be the first to know when new medium vulnerabilities are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

References

NVD ↗ CVE.org ↗ EPSS Data ↗

git.moodle.org: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84545 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-102588 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2543643 moodle.org: https://moodle.org/mod/forum/discuss.php?d=482507

Credits

Upstream acknowledges Vincent Schneider as the original reporter.